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This  is  no  unsolvable 
problem  if  we  face  it  wisely 
and  courageously. 

— Franklin  Delano  Roosevelt 


Anew  normalcy  is  ascendant 
in  cyberspace.  What  does 
this  mean,  and  what  are  the 
implications  for  the  Depart¬ 
ment  of  Defense  (DOD)  cyber  policy?  Some 
characterize  cyber  new  normalcy  as  hybrid, 
multimodal  Internet  conflict,  which  combines 
state-level  lethality  with  amorphous  cyber  for¬ 
mations.'  Others  view  cyber  new  normalcy  as 
a  breathtakingly  broad  and  globally  inclusive 
campaign  of  deliberate  cyber  penetrations 
against  governments,  militaries,  and  com¬ 
mercial  concerns.^  In  a  January  2009  Foreign 
Affairs  article.  Defense  Secretary  Robert  Gates 
described  today’s  new  normalcy  as  the  search 
for  balance  in  defense  capabilities.'  A  few 
examples  might  serve  to  better  illuminate  the 
cyber  new  normalcy  concept. 


During  the  August  2008  conflict 
between  Russia  and  Georgia,  cyber  attack¬ 
ers  used  tools  from  a  Web  site  hosted  by  a 
company  in  Texas  to  attack  a  Georgian  gov¬ 
ernment  Web  site  that  had  been  relocated — 
coincidentally — to  a  Web  hosting  company 
in  Atlanta,  Georgia.''  In  essence,  the  United 
States  experienced  collateral  damage  during 
these  cyber  attacks.  Borderless  cyber  opera¬ 
tions  confounding  border-based  paradigms 
are  not  a  deviation;  it  is  cyber  new  normalcy. 

During  the  December  2008  attacks  in 
Mumbai,  India,  the  attack  teams  used  cable 
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television,  BlackBerry  phones,  Google  Earth 
imagery,  and  global  positioning  system 
information  to  form  an  integrated,  low-cost 
command  and  control  capability  that  enabled 
a  modicum  of  information  superiority.  As 
Ralph  Peters  points  out,  incidents  such  as 
Mumbai  demonstrate  that  nonstate  actors  “do 
not  fear  network- centric  warfare  because  they 
have  already  mastered  it.”^  Mumbai  is  not  an 
outlier;  it  is  cyber  new  normalcy. 

Finally,  in  a  subtle  yet  telhng  sign  of  cyber 
new  normalcy,  hackers  in  2008  attacked  the 
Barack  Obama  and  John  McCain  campaign 
Web  sites,  compromised  Mr.  Obamas  personal 
Twitter  account,  hacked  Repubhcan  Vice  Presi¬ 
dential  candidate  Sarah  Palin’s  email,  and  falsi¬ 
fied  a  Web  account  attributed  to  Vint  Cerf,  one 
of  the  Internet’s  founding  fathers.  It  leaves  us 
wondering:  if  hackers  have  no  contrition  about 
sullying  national  leaders  or  insulting  Internet 
luminaries,  what  is  next?  And  thus,  we  find  the 
essence  of  cyber  new  normalcy:  what  is  next  in 
cyberspace?  And  are  we  prepared? 

The  Modern  American  Experience 

New  normalcy  has  become  an  episodic 
policy  construct  in  U.S.  strategic  ideation. 
National  leadership  has  relied  on  the  new 
normalcy  clarion  call  to  illuminate  moments 
in  time  when  it  is  understood  that  the  Nation 
faces  not  only  a  severe  threat,  but  also  a 
transcending  reorientation.  Often  invoked  in 
times  of  national  crisis,  new  normalcy  in  the 
American  experience  signals  a  cardinal  shift 
in  the  nature  of  U.S.  security. 

For  example,  in  the  winter  of  1937,  the 
effects  of  President  Franklin  Roosevelt’s  New 
Deal  policies  took  an  unexpectedly  negative 
turn — the  “recession  within  a  depression” — 
with  employment  falling  again  to  near 
Depression-era  levels.  In  response.  New  York 
Mayor  Fiorello  LaGuardia  despondently 
observed  that  “instead  of  considering  the 
situation  as  an  emergency,  we  accept  the 
inevitable,  that  we  are  now  in  a  new  normal.”'’ 
Roosevelt’s  new  normalcy  became  the  reality 
of  Federally  guaranteed  economic  security  as 
the  new  basis  for  overall  national  security. 

In  1953,  President  Dwight  Eisenhower 
viewed  the  atomic  realities  of  Soviet  nuclear 
weapons  as  a  new  and  untenable  threat. 
Reflective  of  this  thinking,  a  White  House 
aide  wrote  a  secret  memorandum  highlight¬ 
ing  the  nuclear  age  of  peril  as  “the  new  and  to 
all  intents  permanent  normalcy.”^  President 
Eisenhower  believed  containment  to  be  inad¬ 
equate  against  a  nuclear-armed  Soviet  power; 


therefore,  his  new  normalcy  became  the  “New 
Look”  defense  policy  that  emphasized  mutu¬ 
ally  assured  destruction  through  massive 
retaliation  using  air-atomic  power.® 

On  October  25, 2001,  echoing  a  deep 
national  sense  of  insecurity  after  the  9/11  ter¬ 
rorist  attacks.  Vice  President  Richard  Gheney 
lamented,  “Many  of  the  steps  we  have  now 
been  forced  to  take  will  become  permanent  in 
American  life.  They  represent  an  understand¬ 
ing  of  the  world  as  it  is,  and  dangers  we  must 
guard  against  perhaps  for  decades  to  come.  I 
think  of  it  as  the  new  normalcy.”"  The  Bush- 
Gheney  new  normalcy  thus  became  the  “New 
War,”  instantiated  in  a  fundamental  shift  to 
preclusion,  or  preemptive  self-defense,  under 
a  permanent  state  of  national  emergency.'® 
New  normalcy  defines  a  quintessential 
dichotomy;  the  urge  to  return  to  the  comfort 
and  routine  of  a  normal  state,  confronted 
by  the  realization  that  the  prior  condition 
no  longer  exists.  For  example,  many  in  the 
U.S.  foreign  policy  community  viewed  the 
collapse  of  the  Soviet  Union  as  an  opportu¬ 
nity  for  a  return  to  normalcy  in  American 
foreign  policy,  allowing  the  United  States 
to  cash  in  the  peace  dividend.  Yet  even  as 


mentally  altered  future.  Perhaps  Eisenhower 
best  captured  this  nuance  as  “groping  to  know 
the  full  sense  and  meaning  of  these  times  in 
which  we  live.”" 

U.S.  joint  military  doctrine  includes 
new  normalcy  as  a  central  concept.  From  this 
perspective,  new  normalcy  is  the  condition 
achieved  whereby  an  adversary  is  rendered 
unable  to  oppose  U.S.  strategic  objectives. 
After  achieving  the  operational  endstate,  new 
normalcy  becomes  a  strategic  goal  in  transi¬ 
tion  from  conflict,  which  disrupts  normal 
life,  to  a  new  level  of  stability.  To  achieve 
new  normalcy,  the  U.S.  military,  supported 
by  interagency  and  multinational  partners, 
transitions  from  major  combat  operations  to 
stabilization,  security,  transition,  and  recon¬ 
struction.  In  addition,  adaptive  force  packages 
counter  any  insurgency  resistance  as  the  new 
normalcy  begins  to  take  shape. 

Although  primarily  understood  from 
a  policy  development  point  of  view,  there  is 
also  a  socioscientific  basis  for  comprehension 
of  new  normalcy.  Thomas  Kuhn  posits  that 
when  the  current  normal  condition  cannot 
explain  or  resolve  an  anomaly,  a  crisis  ensues, 
leading  to  a  fundamental  paradigm  shift. 


new  normalcy  in  the  American  experience  signals  a  cardinal 
shift  in  the  nature  of  U.S.  security 


the  Belavezha  Accords  were  being  signed, 
effectively  dismantling  the  Soviet  Union,  the 
tectonic  undertones  of  terrorism  and  global 
fragmentation  were  already  well  in  place. 
The  notion  of  an  American  post-Cold  War 
return  to  a  neo-isolationist  normalcy  was 
but  a  fading  ideal,  when  in  fact  that  prior 
normal  condition  had  long  since  vanished 
under  the  “New  World  Order”  of  Mikhail 
Gorbachev  and  George  H.W.  Bush. 

New  normalcy  can  also  be  seen  as  a 
reaction  to  what  author  Nassim  Nicholas 
Taleb  describes  as  “black  swan”  events — those 
highly  improbable  occurrences  beyond  the 
realm  of  normal  expectations.  What  was  pre¬ 
viously  accepted  as  impossible — even  prepos¬ 
terous — is  suddenly  reality,  leaving  the  Nation 
grasping  for  comprehension  under  forced 
acceptance.  In  this  context,  new  normalcy 
becomes  an  extempore  self-interrogatory, 
compelling  the  citizenry  to  unwillingly  deci¬ 
pher  and  assimilate  the  residue  of  a  perceived 
calamitous  breakdown  in  the  normal  way  of 
life.  New  normalcy  thus  serves  as  the  tenuous 
bridge  to  the  reality  of  an  unknown,  funda¬ 


concluding  in  a  new  state  of  normalcy.  In 
Kuhn’s  normative  transformation  theory,  a 
professional  community  “alter[s]  its  concep¬ 
tion  of  entities  with  which  it  has  long  been 
familiar,  and . . .  shift[s]  the  network  of  theory 
through  which  it  deals  with  the  world.”'^ 

Cyber  New  Normalcy 

At  a  2005  hearing.  Senator  Olympia 
Snowe  alluded  to  waking  up  one  morning 
to  “yet  another  new  normalcy,  just  as  we 
did  on  September  12,  2001.”'®  These  words 
symbolically  parallel  growing  national  senti¬ 
ment  regarding  the  fear  of  a  major  cyber 
disaster — thus,  the  dramatic  rise  in  predic¬ 
tions  of  a  “cyber  Pearl  Harbor”  or  an  “e-9/H” 
event.  Vint  Gerf  even  likens  the  rampant 
spread  of  malware  to  a  “pandemic . . .  that 
could  undermine  the  future  of  the  Internet.”''* 
In  the  end,  Gerf  reflects  circumspectly,  “It 
seems  every  machine  has  to  defend  itself  The 
Internet  was  designed  that  way.  It’s  every  man 
for  himself”'® 

Some  in  the  national  security  com¬ 
munity  question  whether  current  U.S.  cyber 
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strategy  can  meet  the  challenges  of  modern 
cyber  threats.  For  instance,  a  December  2008 
Center  for  Strategic  and  International  Studies 
(CSIS)  report  on  cybersecurity  concludes 
that  protecting  cyberspace  is  “a  battle  we  are 
losing.”“  In  testimony  before  Congress,  Jim 
Lewis,  a  member  of  the  panel  that  wrote  the 
CSIS  report,  stated  that  “the  U.S.  is  disorga¬ 
nized  and  lacks  a  coherent  national  [cyberse¬ 
curity]  strategy.”'^  Similarly,  a  2008  Defense 
Science  Board  report  concludes  that  “there  is 
scant  real  progress  to  better  secure  our  infor¬ 
mation  infrastructure.”'*  The  former  Director 
of  National  Intelligence  believed  the  country 
is  “not  prepared  to  deal  with  current  cyher- 
security  threats.”'*  A  former  special  assistant 
to  the  President  for  critical  infrastructure 
protection  warns:  “Are  we  ready  for  a  large- 
scale  cyber  disruption  or  attack?  I  believe  the 
answer  is  clearly  no.”^“ 

The  daily  tidal  wave  of  ever  more  shock¬ 
ing  revelations  threatens  to  overwhelm,  as  if 
we  are  witnessing  a  recession  in  cybersecurity 
capabilities.  Cyber  attacks  have  resulted  in 
government-wide  computer  infections  and 
loss  of  information.  The  Department  of  State 
admits  to  losing  terabytes  of  information. 


Likewise,  DOD  has  lost  a  volume  of  informa¬ 
tion  equivalent  to  twice  the  number  of  printed 
pages  in  the  Library  of  Congress.  Hackers 
so  pervasively  penetrated  the  U.S.  Bureau  of 
Industry  and  Security  that  the  agency  com¬ 
pletely  disconnected  itself  from  the  Internet. 
The  White  House  itself  has  had  to  deal  with 
unidentified  intrusions  into  its  network,  and 
malware  has  even  infected  laptops  aboard 
the  International  Space  Station.  Due  to  the 
overwhelming  nature  of  these  cyber  threats, 
a  2008  Senate  report  indicated  the  cost  to 
defend  government  networks  could  rise  to  as 
much  as  $17  billion.^' 

The  unprecedented  growth  in  cyber 
threats  has  led  policymakers  and  analysts 
alike  to  assert  with  increasing  frequency 
that  the  United  States  is  experiencing  a  new 
normalcy  in  cyberspace.  As  early  as  2003, 
the  Gilmore  Commission  s  report  on  Forging 
America’s  New  Normalcy  predicted  the  onset 
of  cyber  new  normalcy  conditions,  includ¬ 
ing  cyberterrorism.“  In  commenting  on  the 
increasing  sophistication  of  cyber  attacks,  the 
state  of  Michigan’s  chief  information  security 
officer  recently  noted:  “I  don’t  think  this  is 
just  hype — this  is  the  new  normal.”^'  Perhaps 


the  clearest,  most  unambiguous  recognition 
of  cyber  new  normalcy  is  the  CSIS  2008  report 
on  cybersecurity,  which  invokes  the  spirit  of 
Roosevelt’s  national  emergency,  Eisenhower’s 
nuclear  threat,  and  Bush’s  war  on  terror:  “The 
U.S.  must  treat  cybersecurity  as  one  of  the 
most  important  national  security  challenges 
it  faces. . . .  [T]his  is  a  strategic  issue  on  par 
with  weapons  of  mass  destruction  and  global 
jihad.”^"'  The  following  trends  provide  compel¬ 
ling  evidence  of  this  new  normalcy  condition 
in  cyberspace. 


new  normalcy  is  the  condition 
achieved  whereby  an 
adversary  is  rendered  unable 
to  oppose  U.S.  strategic 
objectives 

Commoditization.  Under  old  normalcy, 
individuals  developed  malware.  Under  cyber 
new  normalcy,  anyone  can  obtain  malware  at 
the  “cyber  drive-through  window.”  The  Inter¬ 
net  is  a  profit-generating  machine  for  criminal 
syndicates  that  have  perfected  malware-as- 
a-service.  The  Organisation  for  Security  and 
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Co-operation  in  Europe  estimates  that  the 
cyher  underground  now  rakes  in  a  stagger¬ 
ing  $100  billion  per  year.^^  Reflective  of  this 
trend,  during  the  Georgian-Russian  conflict, 
hackers  posted  downloadable  malware  on 
public  Web  sites  with  instructions  on  how 
to  join  in  the  cyber  attack  against  Georgia. 

An  Internet  journalist  investigating  the  issue 
concluded:  “All  I  needed  to  do  was  to  save  a 
copy  of  a  certain  web  page  to  my  hard  drive 
and . . .  voila:  my  browser  was  now  sending 
thousands  of  queries  to  the  most  important 
Georgian  sites,  helping  to  overload  them. . . . 
[I]n  less  than  an  hour,  I  had  become  an  Inter¬ 
net  soldier.”^ 

Identification.  Under  old  normalcy, 
when  bombs  and  bullets  flew,  identification 
of  the  adversary  was  relatively  easy.  In  cyber 
new  normalcy,  identification  is  the  exception. 
In  Here  Comes  Everybody,  author  Glay  Shirky 
attributes  “ridiculously  easy  group  formation” 
as  the  Internet’s  defining  characteristic.^’  The 
Estonian  and  Georgian  cyber  events  serve 
as  the  quintessential  examples  of  this  state 
versus  ad  hoc  cyber  assemblage  phenomenon. 
Although  some  initially  declared  the  events  as 
cyberwar,  most  in  the  international  commu¬ 
nity  now  characterize  these  incidents  as  cyber 
crime  via  a  proxy  apparatchik  of  instanta¬ 
neous  cyber  militia-mobs.  At  best,  according 
to  Estonian  officials,  it  is  terrorism.’* 

Distrust.  Under  old  normalcy,  we 
trusted  but  verified.  Under  cyber  new  nor¬ 
malcy,  there  is  no  trust,  and  verification  is 
highly  suspect.  Malware  can  spoof  and  effec¬ 
tively  nullify  antivirus  and  firewall  systems. 
Even  worse,  a  team  of  Dutch  and  Swiss 
researchers  have  broken  the  MD5  encryption 
algorithm  used  by  nearly  all  Internet  Web 
browsers.”  With  MD5  compromised,  it  is  now 
possible  that  Web  browsers  could  erroneously 
verify  forged  digital  signatures  or  software 
certificates,  compromising  previously  trusted 
Internet  transactions  with  little  indication  of 
foul  play. 

Symmetry.  Under  old  normalcy,  cyber 
was  seen  as  an  asymmetric  capability.  Under 
cyber  new  normalcy,  cyber  attacks  are  no 
longer  asymmetric;  they  are  expected.  As 
Verisign  analyst  Eli  Jellenc  points  out:  “We  are 
witnessing . . .  the  birth  of  true,  operational 
cyber  warfare.”**  Similarly,  Representative  Jim 
Langevin  of  the  House  Homeland  Security 
Committee  asserts,  “Never  again  will  we  see 
major  warfare  without  a  strong  cyber  com¬ 
ponent.”*'  Cyber  today  is  ubiquitously  many- 
to-many:  weak  attack  weak,  strong  attack 


weak,  and  weak  attack  strong.  Asymmetric 
warfare  is  generally  considered  the  domain 
of  the  weaker  party  in  applying  unconven¬ 
tional  methods  to  exploit  vulnerabilities  of 
the  strong.  Given  this,  it  is  questionable  if 
the  asymmetry  precept  still  applies  to  cyber. 
Russian-inspired  hackers  have  in  succession 
attacked  Estonia,  Lithuania,  and  Georgia. 
These  are  the  attacks  of  the  cyber  strong 
against  the  cyber  weak.  Iranian  Shi’a  and 
Arab  Sunni  hackers  carry  out  “Koranic  retali¬ 
ation”  cyber  attacks  against  each  other.  Indian 
and  Pakistani  patriotic  hackers  engage  in  sus¬ 
tained  cyber  skirmishes.  When  the  Lebanese 
government  tried  to  prevent  Hizballah  from 
operating  its  own  fiber  optic  network,  Hizbal¬ 
lah  declared  the  affront  as  tantamount  to  war 
and  responded  by  taking  over  West  Beirut. 
Cyber  operations  are  now  the  very  definition 
of  modern  conventional  tactics. 


Deterrence.  Under  old  normalcy, 
“deterrence  by  denial”  defined  the  core  U.S. 
cyber  policy.*’  Cyber  new  normalcy  admits 
that  deterrence  has  failed  to  substantively 
alter  the  motivational  calculus  of  determined 
cyber  attackers.  As  Jim  Gosler  points  out  in 
“Digital  Dimensions,”  cyber  defenses  are 
mismatched  against  the  offensive  efforts  of 


cyber  adversaries.  Over  a  decade  ago,  Richard 
Harknett  argued  that  deterrence  models 
developed  during  the  Cold  War  will  provide 
“poor  guidance”  for  strategic  thinking  about 
cyber  deterrence.**  The  well-regarded  Cyber 
Conflict  Studies  Association  indicates  that  to 
date  there  is  no  compelling  evidence  refuting 
Harknett ’s  position.  This  situation  will  likely 
continue  unabated  until  the  penalties  for 
cyber  attacks  begin  to  outweigh  the  gains. 

The  New  Balance 

In  facing  the  new  normalcy  of  today’s 
complex  defense  environment.  Secretary 
Gates  offers  an  insightful  way  ahead.  In 
January  2009,  he  established  “balance”  as 
the  defining  principle  of  the  Pentagon’s  new 
National  Defense  Strategy.*"*  In  effect,  the 
Secretary’s  vision  can  be  seen  as  the  call  for 
a  New  Balance  in  DOD  capabilities,  and  it 


establishes  a  practical  framework  for  address¬ 
ing  cyber  new  normalcy.  In  line  with  joint 
doctrine,  cyber  New  Balance  could  be  defined 
as  the  quest  to  attain  a  new  level  of  stability  in 
the  DOD  cyber  environment  in  order  to  better 
support  U.S.  strategic  objectives. 

Secretary  Gates’  call  for  a  New  Balance 
is  strikingly  reminiscent  of  the  new  normalcy 


under  cyber  new  normalcy  cyber  attacks  are  no  longer 
asymmetric;  they  are  expected 
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experiences  of  the  Roosevelt,  Eisenhower,  and 
Bush  administrations.  For  example,  in  his  first 
inaugural  address,  Roosevelt  called  for  a  frank 
and  honest  discussion  regarding  the  Nation’s 
economic  ills.  Secretary  Gates’  New  Balance 
similarly  calls  for  a  blunt  assessment  of  the 
current  U.S.  defense  posture.  In  line  with  this 
thinking,  cyber  new  normalcy  warrants  a 
frank,  realistic  assessment  of  the  New  Balance 
needed  in  DOD  cyber  capabilities.  A  funda¬ 
mental  premise  of  cyber  new  normalcy  is  that 
a  New  Balance  is  required  in  culture,  conduct, 
and  capabilities  in  order  to  better  operate 
and  defend  in  and  through  cyberspace.  A 
judicious  cyber  New  Balance  policy  would 
reassess  DOD -wide  priorities  in  areas  such 
as  offense  balanced  with  defense,  personal 
use  balanced  with  official  use  of  military 
networks,  compliance  balanced  with  account¬ 
ability  in  network  usage,  and  permitting 
versus  restricting  unfettered  Internet  access 
from  the  global  information  grid.  As  Kuhn 
warned,  these  changes  may  be  difficult  to 
accept  for  those  entrenched  within  the  current 
paradigm.  It  may  unfortunately  take  a  Billy 
Mitchell  moment — a  “cyber  Ostfriesland” — to 
truly  convince  skeptics  of  the  reality  of  cyber 
new  normalcy. 

Secretary  Gates’  call  for  a  renewed  focus 
on  U.S.  deterrence  policy  evokes  President 
Eisenhower’s  New  Look  emphasis  on  strategic 
deterrence.  An  enlightened  cyber  strategy 
would  seek  an  appropriate  balance  between 
secrecy  and  openness.  While  working  at 
RAND  in  the  early  1960s,  Paul  Baran  con¬ 
ceived  the  digital  packet  switching  concept 
used  to  establish  a  survivable  U.S.  nuclear 
command  and  control  system.  Significantly, 
Baran  openly  published  his  work,  with  the 
U.S.  Government’s  implied  consent,  under 
the  premise  that  “deterrence  only  works  if  the 
other  guy  knows.”^^  Harknett  similarly  argues 
that  deterrence  is  contingent  on  the  challenger 
and  the  deterrer  possessing  shared  knowledge 
about  each  other.^'’  A  perceptive  cyber  New 
Balance  protocol  would  openly  communicate 
certain  capabilities  and  intentions  in  order  to 
strengthen  cyber  deterrence.  Credible  deter¬ 
rence  will  also  require  balanced  resourcing 
for  identification  and  authentication;  data 
hardening  and  network  resiliency;  cyber  intel¬ 
ligence,  surveillance,  and  reconnaissance;  and 
cyber  early  warning  and  response. 

Mindful  of  the  Bush  New  War,  Secretary 
Gates’  New  Balance  seeks  solutions  to  hybrid 
conflict.  Cyber  new  normalcy  reflects  Ralph 
Peters’  notion  of  a  “counter-revolution  in  mili¬ 


tary  affairs.”’^  In  essence,  an  evolving  “coun¬ 
ter-revolution  in  cyber  affairs”  defines  cyber 
new  normalcy.  An  adroit  New  Balance  cyber 
policy  would  encourage  an  honest  assessment 
of  the  military  means  for  engaging  in  cyber 
conflict  and  determine  the  relevancy  to  cyber 
new  normalcy  conditions.  As  witnessed  in 
the  cyber  attacks  on  Estonia,  Lithuania,  and 
Georgia,  non-mirror-imaging  adversaries 
have  a  well-honed  grasp  of  operating  within 
the  grey  area  of  cyber,  below  the  threshold  of 
use  of  force.  Deterritorialized  attackers  target 
territorialized  infrastructure,  frustrating 
border-based  orthodoxy.  These  hybrid  cyber 


should  motivate  international  law  to  accom¬ 
modate  and  even  encourage  the  judicious 
application  of  cyber  operations.®  However, 
while  some  have  asserted  that  the  United 
States  is  at  war  in  cyberspace  today,  there 
must  also  be  follow-through  in  articulating 
the  strategy  and  conditions  for  a  discernible 
end.  Implying  an  undefined  and  unending 
cyberwar  could  lead  to  the  misperception 
that  the  United  States  seeks  militarization  of 
the  Internet.  In  addition,  international  law 
remains  immature  for  determining  when  a 
cyber  event  crosses  the  threshold  triggering 
use  of  force.  Gyber  New  Balance  would  seek 


a  perceptive  cyber  New  Balance  protocol  would  openly 
communicate  certain  capabilities  and  intentions  in  order  to 
strengthen  cyber  deterrence 


militia-mobs  clearly  demonstrate  that  adver¬ 
saries  will  not  fight  the  U.S.  military  on  its 
own  terms  in  cyberspace.  In  fact,  military-on- 
military  in  cyberspace  may  become  the  excep¬ 
tion,  rather  than  the  norm,  with  relatively  few 
“lawful  combatants”  in  the  traditional  sense. 
An  astute  strategy  would  seek  to  refine  the 
understanding  of  how  “military  affairs”  fits 
within  a  cyber  world  where  predominantly 
industry  and  noncombatant  civilians  estab¬ 
lish  and  control  the  core  operational  theater 
of  conflict.  The  counterrevolution  in  cyber 
affairs  will  necessitate  development  of  alterna¬ 
tive  tactics  against  this  global  amalgam  of 
state,  state-sponsored,  and  nonstate  actors. 

In  addition  to  the  above,  a  wise  cyber 
New  Balance  would  prudently  avoid  the 
“lO-foot-tall  Ivan”  syndrome  that  some 
analysts  argue  symbolically  represented 
overstated  Soviet  Cold  War  capabilities. 

A  thoughtful  approach  would  seek  a  con¬ 
scientious  balance  between  cybersecurity 
and  openness,  and  inclusively  engage  the 
public.  The  Gilmore  Commission  succinctly 
captured  the  essence  of  this  tension  by  sug¬ 
gesting  that  any  new  normalcy  policy  should 
include  “heightened  security  but  not  with 
such  an  obsessiveness  that  it  would  destroy 
the  economic  base  or  the  civil  freedoms  of  the 
country.”® 

Finally,  a  sensible  New  Balance  policy 
would  rationally  approach  the  issue  of  cyber¬ 
war.  Cyber  weapons  may  offer  the  advantage 
of  low  cost  in  terms  of  human  life  and  physical 
damage.  In  fact,  a  growing  line  of  thought 
suggests  that  the  potentially  nonlethal  and 
discriminative  nature  of  cyber  weapons 


to  avoid  unproductive  discourse  of  endless, 
boundless  cyberwar  while  constructing  a 
methodology  for  discriminating  between 
cybercrime,  cyberterrorism,  and  the  conduct 
of  legitimate  military  cyber  operations. 

Lessons  from  the  Roosevelt,  Eisen¬ 
hower,  and  Bush  new  normalcy  cases  provide 
compelling  evidence  to  suggest  that  enlight¬ 
enment,  rather  than  retrenchment,  is  the 
path  for  cyber  New  Balance.  The  economic 
calamity  of  the  Great  Depression  directly 
confronted  Roosevelt,  as  the  Soviet  nuclear 
arsenal  did  Eisenhower  and  terrorism  did 
Bush.  The  threats  were  known  and  real.  Simi¬ 
larly,  cyher  threats  are  real  and  have  evolved. 
In  the  face  of  fractious  cyber  challenges,  an 
insightful  reevaluation  of  DOD  cyber  policy 
is  advisable. 

With  Secretary  Gates’  New  Balance  as 
the  fundamental  underpinning,  DOD  has  a 
compelling  opportunity  to  rebalance  cyber 
priorities  in  line  with  the  realities  of  cyber 
new  normalcy.  A  comprehensive  cyber  New 
Balance  effort  recognizes  that  action  must 
be  taken  across  the  entirety  of  the  defense 
community,  including  defense  industrial  base 
partners.  Progress  necessitates  identification 
and  resolution  of  entrenched  technical  and 
cultural  impediments  that  hamper  progress. 
A  New  Balance  strategy  can  attain  true  cyber 
new  normalcy  through  change  in  culture  and 
conduct,  improved  technical  capabilities,  and 
altered  policy  constructs  that  deliver  mean¬ 
ingful  deterrence.  Failing  these,  DOD  cyber 
capabilities  will  undoubtedly  remain  ossified 
under  old  normalcy.  JFQ 
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